Cli: [BUG] npm install or npm update sometimes trashes lockfile, setting `resolved: false`

[taylorjdawson]

Note: I am porting this issue over from the now archived npm.community with the hopes that this issue can get escalated and resolved as it looks like it has been largely overlooked up to this point. Maybe this issue can be set to resolved: true 😉

---

What / Why

• My package-lock.json constantly toggles between:

 "resolved": "https://registry.npmjs.org/tar/-/tar-4.4.1.tgz",
  "resolved": false,

When

• n/a

Where

• n/a

How

Current Behavior

• Running npm install or npm update sometimes trashes the lockfile, setting resolved: false for a number of packages.

Steps to Reproduce

• Run npm install or npm update
• Check package-lock.json for changes

Expected Behavior

• resolve does not switch between false and the URL.

Who

• n/a

References

• https://npm.community/t/constant-resolved-false-toggle/276
• https://github.com/RocketChat/Rocket.Chat/issues/15408
• https://npm.community/t/npm-install-or-npm-update-turns-a-bunch-of-resolved-in-package-lock-json-from-real-values-to-false/3308
• https://github.com/DoSomething/rogue/pull/974#discussion_r362875844

[aduth]

We've been encountering this quite frequently in WordPress/gutenberg lately.

• https://github.com/WordPress/gutenberg/issues/16157#issuecomment-599589261
• https://github.com/WordPress/gutenberg/pull/21873#discussion_r418234268
• https://github.com/WordPress/gutenberg/pull/21424#discussion_r404778909
• https://github.com/WordPress/gutenberg/pull/20555#discussion_r402991541
• https://github.com/WordPress/gutenberg/pull/21306
• https://wordpress.slack.com/archives/C02QB2JS7/p1588692036240600 (link requires registration)

Some possibly relevant additional details:

• The packages which fluctuate are often "optional": true, or transitive dependencies of an "optional": true (e.g. nopt, node-pre-gyp, fsevents).
• Our project is structured as a monorepository, with many dependencies in package.json defined as local filesystem dependencies.

[jzaefferer]

For anyone else encountering this problem: rm -rf node_modules/ && npm cache clean --force && npm install helped in my case.